detection-rules
detection-rules copied to clipboard
[Bug] Creating New Terms via CLI
Describe the Bug
Summary
Creating a new terms rule via the CLI will currently not prompt the user to supply the new_terms field(s) preventing the user from being able to create the rule.
(See gif for details)
To Reproduce
- Run
python -m detection_rules create-rule - Choose new-terms
- Attempt to complete rule
- See error
Expected Behavior
Rule should be created successfully.
Screenshots
Desktop - OS
None
Desktop - Version
No response
Additional Context
At a minimum changing line 188 of detection_rules/cli_utils.py result["value"] = schema_prompt("new_terms_fields", value=kwargs.pop("new_terms_fields")) to result["value"] = schema_prompt("new_terms_fields", value=kwargs.pop("new_terms_fields", None)) will resolve the initial issue of the lack of prompt for new_terms fields, but I expect more changes will be needed to fix the issue.